Security Slap: How Could Elevator Video Have Leaked?

Celebrities can take back exits and limos with tinted windows to dodge the paparazzi -- but a leaked videothat purportedly shows Beyoncé’s sister beating up on Jay Z in the elevator of a swanky New York hotel is a reminder that there are still plenty of ways to be caught on candid camera.

The grainy footage obtained by entertainment website TMZ allegedly shows Solange Knowles roughing up the rapper, and was reportedly recorded by a surveillance camera on May 5 at The Standard hotel. While it’s unclear how the footage was leaked, multiple people could have accessed the archives, a security expert told NBC News.

"We are shocked and disappointed that there was a clear breach of our security system and the confidentiality that we count on providing our guests," The Standard hotel told The Grio in an email. The company added it is "investigating with the utmost urgency."

Representatives for Beyonce, Jay Z, and Solange Knowles did not return requests for comment from NBC News.

Tony Bañuelos, who works extensively with security cameras and recorders as a tech support specialist for Texas-based A1 Security Cameras, explained to NBC News how elevator security cameras systems typically work -- and who might have been able to access the stored footage.

In the age of surveillance cameras everywhere, celebrities can be caught unaware just like the rest of us.

The reported Jay Z-Solange brouhaha occurred one week after Baltimore Ravens running back Ray Rice pleaded not guilty to assault charges from a February incident with his then-girlfriend in an Atlantic City casino elevator. TMZ also published footage of that alleged scuffle.

In the age of surveillance cameras everywhere, celebrities can be caught unaware just like the rest of us.

So how’d the footage get from a supposedly secure setup to the Internet? According to Bañuelos, most hotels' elevator security cameras feature cables that run down the elevator shaft to a security booth that's typically in the basement. The cables connect to screens that security staffers can monitor live. Most large companies hire staffers to watch the screens around the clock, Bañuelos said.

The security booths also include recorders that store the video, and they're usually kept in a separate room with hard drives of archives, Bañuelos said. Companies typically hang on to the footage for 60 days, although each state requires different storage periods for insurance purposes.

TMZ reported that the video published on its site on Monday captured Solange Knowles launching an assault on the ‘Black Album’ rapper, who does not appear to hit back in the video. A bodyguard appears to restrain her in the footage, and stop the elevator.

But that didn’t stop the whole Internet from finding out.

"Think of the video recorder like a locked desktop computer: Each one requires a username and password."

Whoever accessed the recorder for security camera footage would have needed login credentials, according to Bañuelos.

"Think of the video recorder like a locked desktop computer: Each one requires a username and password, and you can give some users administrative rights and others limited rights," Bañuelos said.

But security officers aren't the only ones who can access the recorder: Security companies like Bañuelos' can remotely log in, and so could staffers at the manufacturer that made the recorder.

Also, sometimes companies don't change the default login information for a recorder -- and that information is often publicly available online.

"I have seen even bigger organizations make rookie mistakes like that," Bañuelos said.

Once a person accesses the video recorder, it's easy to export clips to a USB drive, a CD, or even just by regular old email.

So will the hotel be able to track down how the footage that appears to show one of hip-hop’s biggest stars got leaked to the world?

Activity logs vary from business to business, Bañuelos said, but most recorders will at least show which user signed in and when they were active. Some devices go further, detailing the user's actual activity -- for example, if they attempted to export and send a video clip.